From 664c5baecc9f6899d78ccfa36ac3ee2acff7399f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 13:29:47 +0000
Subject: [PATCH] Bump the test-and-tooling group with 6 updates

Bumps Microsoft.CodeAnalysis.Analyzers from 3.3.4 to 5.9.0
Bumps Microsoft.CodeAnalysis.CSharp from 4.8.0 to 5.9.0
Bumps Microsoft.CodeAnalysis.CSharp.Workspaces from 4.8.0 to 5.9.0
Bumps Microsoft.NET.Test.Sdk from 17.14.1 to 18.11.0
Bumps System.Security.Cryptography.Pkcs from 10.0.13 to 10.0.14
Bumps xunit.runner.visualstudio from 3.1.4 to 4.0.1

---
updated-dependencies:
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.Analyzers
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.CodeAnalysis.CSharp.Workspaces
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: System.Security.Cryptography.Pkcs
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-and-tooling
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-and-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 src/SheetStream.Analyzers/SheetStream.Analyzers.csproj    | 4 ++--
 src/SheetStream.Generators/SheetStream.Generators.csproj  | 4 ++--
 .../SheetStream.Analyzers.Tests.csproj                    | 8 ++++----
 .../SheetStream.Generators.Tests.csproj                   | 6 +++---
 4 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj b/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj
index 4545293..27687fb 100644
--- a/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj
+++ b/src/SheetStream.Analyzers/SheetStream.Analyzers.csproj
@@ -25,8 +25,8 @@
     <!-- 4.8.0 is the oldest compiler the analyzer supports (VS 2022 17.8 / .NET SDK 8.0). Newer compilers load
          analyzers built against older Microsoft.CodeAnalysis, so staying low maximises compatibility. PrivateAssets
          keeps the compiler assemblies out of any package that references this project. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/SheetStream.Generators/SheetStream.Generators.csproj b/src/SheetStream.Generators/SheetStream.Generators.csproj
index 99e2143..aafd07c 100644
--- a/src/SheetStream.Generators/SheetStream.Generators.csproj
+++ b/src/SheetStream.Generators/SheetStream.Generators.csproj
@@ -24,8 +24,8 @@
   <ItemGroup>
     <!-- 4.8.0 is the compiler shipped with .NET 8 / VS 17.8: the oldest host the generator supports.
          Newer SDKs (including .NET 10) load it unchanged. PrivateAssets keeps it out of any consumer's graph. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" PrivateAssets="all" />
-    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" PrivateAssets="all" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj b/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj
index f676f74..d165a39 100644
--- a/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj
+++ b/tests/SheetStream.Analyzers.Tests/SheetStream.Analyzers.Tests.csproj
@@ -12,13 +12,13 @@
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Analyzer.Testing" Version="1.1.4" />
     <!-- The testing package only states a 1.0.1 floor for Workspaces, which restores as a .NET Framework package
          (NU1701). Pinning the same compiler version the analyzer builds against keeps restore clean. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.8.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.9.0" />
     <!-- Transitive dependency of the NuGet client used by the testing package; its default version has a known
          vulnerability (NU1903), so pull a patched one. Not used by the tests themselves. -->
-    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.14" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj b/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj
index 280a6c2..57ba31d 100644
--- a/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj
+++ b/tests/SheetStream.Generators.Tests/SheetStream.Generators.Tests.csproj
@@ -10,11 +10,11 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1" />
     <!-- Same Roslyn the generator is compiled against, for the CSharpGeneratorDriver tests. -->
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
   </ItemGroup>
 
   <ItemGroup>